diff --git a/policy/flask/access_vectors b/policy/flask/access_vectors index 2d084f510..2702bbabd 100644 --- a/policy/flask/access_vectors +++ b/policy/flask/access_vectors @@ -696,8 +696,6 @@ class packet send recv relabelto - flow_in # deprecated - flow_out # deprecated forward_in forward_out } diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in index 6077a816f..5a2661c54 100644 --- a/policy/modules/kernel/corenetwork.te.in +++ b/policy/modules/kernel/corenetwork.te.in @@ -355,7 +355,7 @@ typealias netif_t alias lo_netif_t; allow corenet_unconfined_type node_type:node { recvfrom sendto }; allow corenet_unconfined_type netif_type:netif { ingress egress }; -allow corenet_unconfined_type packet_type:packet { send recv relabelto flow_in flow_out forward_in forward_out }; +allow corenet_unconfined_type packet_type:packet { send recv relabelto forward_in forward_out }; allow corenet_unconfined_type port_type:tcp_socket { name_connect }; allow corenet_unconfined_type port_type:sctp_socket { name_connect }; diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te index 103a936fc..6b255797c 100644 --- a/policy/modules/kernel/kernel.te +++ b/policy/modules/kernel/kernel.te @@ -523,5 +523,5 @@ allow kern_unconfined unlabeled_t:chr_file { manage_chr_file_perms relabelfrom r allow kern_unconfined unlabeled_t:dir { manage_dir_perms relabelfrom relabelto append map execute quotaon mounton add_name remove_name reparent search rmdir audit_access execmod }; allow kern_unconfined unlabeled_t:filesystem { mount remount unmount getattr relabelfrom relabelto associate quotamod quotaget }; allow kern_unconfined unlabeled_t:association { sendto recvfrom setcontext polmatch }; -allow kern_unconfined unlabeled_t:packet { send recv relabelto flow_in flow_out forward_in forward_out }; +allow kern_unconfined unlabeled_t:packet { send recv relabelto forward_in forward_out }; allow kern_unconfined unlabeled_t:process { fork signal_perms ptrace getsched setsched getsession getpgid setpgid getcap setcap share getattr setexec setfscreate noatsecure siginh setrlimit rlimitinh setcurrent setkeycreate setsockcreate getrlimit };